A new OAuth vulnerability has been discovered in three of the major extensions such as Grammarly, Vidio, and Bukalapak. These applications use the OAuth protocol for their authentication, which is vulnerable to an authentication token-stealing attack.
OAuth is an authentication protocol that was introduced in 2006 and acts as a passwordless signing-in for many applications through social media accounts such as Facebook, Twitter, or Google.
This particular flaw could affect millions of users as all of these affected vendors have combined to have more than 100M users. However, all of the affected vendors acted swiftly upon the reported issues and fixed them accordingly.
If an application has implemented OAuth authentication for its users, the application must validate if the authentication token is from a legitimate vendor or a malicious token.
In such a case, if the applications do not validate the token, threat actors can create a malicious website and insert their token from Facebook or Google to hijack the user’s account on the affected application.
Moreover, threat actors can lure multiple victims and perform massive account hijacking if the website has a great reputation.
For demonstration purposes, researchers created a malicious website with Facebook developers and gained an OAuth authentication token for their application.
Furthermore, they replaced this token with this vulnerable application’s authentication token, which resulted in an account hijack.
It was also mentioned that these were just sample applications, and there are still thousands of applications that lack this token validation and are vulnerable to massive account hijacks.
A complete report about this attack has been published by Salt Security, which provides detailed information about the attack, source code, mechanism, and other information.
It is recommended that developers implement a token validation for OAuth tokens to prevent this kind of exploitation by threat actors.
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.
A sophisticated cyber campaign orchestrated by the Chinese Advanced Persistent Threat (APT) group, Silver Fox,…
A new wave of cyberattacks attributed to the Ghostwriter Advanced Persistent Threat (APT) group has…
The LCRYX ransomware, a malicious VBScript-based threat, has re-emerged in February 2025 after its initial…
Recent cybersecurity investigations have uncovered a sophisticated technique employed by threat actors to evade detection…
A financial management app named Finance Simplified has been revealed as a malicious tool for…
A recent discovery by cybersecurity researchers has revealed that the Poseidon malware, a macOS-targeting trojan,…